stream: avoid use-after-free

virFDStreamClose used a mutex after it was freed, and failed
to destroy that mutex on its last use.

* src/fdstream.c (virFDStreamFree): Inline into sole caller...
(virFDStreamClose): ...to avoid use-after-free and leak.
Reported by Matthias Bolte.

diff --git a/src/fdstream.c b/src/fdstream.c
index 2702ad7e43820b13e63db109310ad955e9f401e5..e19694f24907178dfa94e525929d760148a0cdf1 100644 (file)
--- a/src/fdstream.c
+++ b/src/fdstream.c
@@ -210,9 +210,20 @@ cleanup:
     return ret;
 }
 
-static int virFDStreamFree(struct virFDStreamData *fdst)
+
+static int
+virFDStreamClose(virStreamPtr st)
 {
+    struct virFDStreamData *fdst = st->privateData;
     int ret;
+
+    VIR_DEBUG("st=%p", st);
+
+    if (!fdst)
+        return 0;
+
+    virMutexLock(&fdst->lock);
+
     ret = VIR_CLOSE(fdst->fd);
     if (fdst->cmd) {
         char buf[1024];
@@ -243,29 +254,12 @@ static int virFDStreamFree(struct virFDStreamData *fdst)
         }
         virCommandFree(fdst->cmd);
     }
-    VIR_FREE(fdst);
-    return ret;
-}
-
-
-static int
-virFDStreamClose(virStreamPtr st)
-{
-    struct virFDStreamData *fdst = st->privateData;
-    int ret;
-
-    VIR_DEBUG("st=%p", st);
-
-    if (!fdst)
-        return 0;
-
-    virMutexLock(&fdst->lock);
-
-    ret = virFDStreamFree(fdst);
 
     st->privateData = NULL;
 
     virMutexUnlock(&fdst->lock);
+    virMutexDestroy(&fdst->lock);
+    VIR_FREE(fdst);
 
     return ret;
 }